Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    7s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2023, 20:46

General

  • Target

    f706b7f8e00244ee908cfa71d6ff4e89.exe

  • Size

    874KB

  • MD5

    f706b7f8e00244ee908cfa71d6ff4e89

  • SHA1

    a37c5cb12d1f92ff02f1e8c7542f274eb419f634

  • SHA256

    132fd79642f57a79e412e7c7b8827eb272357ca1803754a5cbee18eadd0047d2

  • SHA512

    ed0d0a9b3ed315dcde1c5a112aca8fdb24ad88740c438df97918bb0a22482be30dd3257cd2711c9c34a8183c61d7b1eb19880aa26b7c8eacb3154c8ad5021eb9

  • SSDEEP

    24576:4CMLKmtvPyHu7Dh/jIoy9pNg4W7HMX8G3bOAHCv+:JiKmHyOnNISp7sXjv

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f706b7f8e00244ee908cfa71d6ff4e89.exe
    "C:\Users\Admin\AppData\Local\Temp\f706b7f8e00244ee908cfa71d6ff4e89.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Users\Admin\AppData\Local\Temp\f706b7f8e00244ee908cfa71d6ff4e89.exe
      "C:\Users\Admin\AppData\Local\Temp\f706b7f8e00244ee908cfa71d6ff4e89.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4788
  • C:\Users\Admin\AppData\Local\Temp\f706b7f8e00244ee908cfa71d6ff4e89.exe
    "C:\Users\Admin\AppData\Local\Temp\f706b7f8e00244ee908cfa71d6ff4e89.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    PID:4952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ujUdXjx0CDTiFhvZx9N\extramod.dll

    Filesize

    73KB

    MD5

    ad6e05d9ba6ec43731b15a0ff98ae1c0

    SHA1

    c360ec878752a4170bd6842ce91fc51aac84660c

    SHA256

    804680c268cdf42564011784defa437b259de50823245499f7e2635e636bf40b

    SHA512

    ff49dc03e69b52dfd957d4e07b82013006462bb8e6ac24f7d88c62400ec340f2c79d38ca6f8116a9af51c77d08d480778d3c8d56529d11ddcd9cfd167b4e9308

  • C:\Users\Admin\AppData\Local\Temp\ujUdXjx0CDTiFhvZx9N\loading_screen.dll

    Filesize

    5KB

    MD5

    44dac7f87bdf94d553f8d2cf073d605d

    SHA1

    21bf5d714b9fcab32ba40ff7d36e48c378b67a06

    SHA256

    0e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66

    SHA512

    92c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774

  • C:\Users\Admin\AppData\Local\Temp\ujUdXjx0CDTiFhvZx9N\lua51.dll

    Filesize

    494KB

    MD5

    f0c59526f8186eadaf2171b8fd2967c1

    SHA1

    8ffbe3e03d8139b50b41931c7b3360a0eebdb5cb

    SHA256

    6e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6

    SHA512

    dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854

  • C:\Users\Admin\AppData\Local\Temp\ujUdXjx0CDTiFhvZx9N\shared_library.dll

    Filesize

    200KB

    MD5

    525c9dbb9cfafc0d007078dc2d134dff

    SHA1

    f966d327bbcd7825aa11bc39a67ef582a531c306

    SHA256

    fbc468440aed660aab73dac4ed8a736dbc5ef028a8168c84fe605226063a99ee

    SHA512

    0a84c2adfc5fdb791a736adf7810cb1042fe23c9251400adc3f1177edeaefd54dd436f3f9825537bb4cc1d0554583f0a14e00676fbe9068e5f1d9b7c3eaf539f

  • memory/4952-14-0x0000000002120000-0x0000000002156000-memory.dmp

    Filesize

    216KB

  • memory/4952-18-0x000000007FE30000-0x000000007FE40000-memory.dmp

    Filesize

    64KB

  • memory/4952-24-0x000000007FE40000-0x000000007FE50000-memory.dmp

    Filesize

    64KB

  • memory/4952-17-0x000000007FE40000-0x000000007FE50000-memory.dmp

    Filesize

    64KB

  • memory/4952-7-0x0000000002100000-0x0000000002116000-memory.dmp

    Filesize

    88KB